Pennsylvania Deepfake and AI Abuse Law

Overview

In October 2024, Pennsylvania Governor Josh Shapiro signed Pennsylvania Act 125 of 2024 into law, establishing significant updates to the Commonwealth criminal code to address the rapid rise and misuse of artificial intelligence (AI) and synthetic media technology. Generative AI tools have made it increasingly effortless to create hyper-realistic visual, video, and audio depictions of individuals in situations that never occurred in reality. When weaponized, these digital tools enable severe forms of image-based sexual abuse, cyber-harassment, and extortion. Act 125 directly confronts these risks by updating Title 18 of the Pennsylvania Consolidated Statutes (Crimes and Offenses) to explicitly criminalize nonconsensual AI-generated sexual depictions and synthetic child sexual abuse material.

Act 125 provides law enforcement agencies, including the Pennsylvania Office of Attorney General and county district attorneys, with express statutory authority to investigate and prosecute bad actors who generate or disseminate artificial intimate imagery. By modernizing 18 Pa.C.S. § 3131 (Nonconsensual dissemination of intimate image) and 18 Pa.C.S. § 6312 (Sexual abuse of children), the legislation ensures that existing protections against intimate image abuse and child exploitation apply equally to digitally synthesized content. The law reflects a growing legislative movement across the United States to establish comprehensive legal boundaries surrounding generative media and to protect individuals from online sexual exploitation across educational, civic, and private sectors.

Definitions

Act 125 integrates new technology-specific definitions into Title 18 of the Pennsylvania Consolidated Statutes to ensure clarity in law enforcement and legal proceedings. Central to the statute is the inclusion of artificial intelligence-generated media under existing statutory prohibitions against nonconsensual intimate imagery and child exploitation. Under 18 Pa.C.S. § 3131, an 'AI-generated sexual depiction' encompasses any visual media, including computer-generated images, deepfake videos, or altered digital photographs, created or modified using artificial intelligence algorithms or machine learning models that depict a real, identifiable individual in a state of nudity or engaged in sexual conduct without their express consent.

Furthermore, under 18 Pa.C.S. § 6312, the legal definition of 'Child Sexual Abuse Material' (CSAM) is broadened to expressly include any AI-generated visual media depicting a minor or simulated minor engaged in sexually explicit acts. The statute emphasizes specific criminal intent elements, defining actionable dissemination as conduct executed with the intent to 'harass, annoy, or alarm' another person. Related statutory measures, such as Act 35 of 2025 (18 Pa.C.S. § 4101.1), further refine terms such as 'forged digital likeness' to cover computer-generated audio, video, or visual recordings created with the intent to defraud or injure individuals across Pennsylvania jurisdictions.

Governance and Institutional Framework

The operational framework established under Act 125 spans state law enforcement agencies, prosecuting attorneys, educational bodies, and administrative departments. Primary criminal enforcement authority rests with the Pennsylvania Office of Attorney General (OAG) alongside local municipal police departments and county district attorneys. The Office of Attorney General plays a lead role in conducting complex digital forensic investigations, utilizing specialized cybercrime units to track down perpetrators of synthetic intimate media dissemination and illegal CSAM creation.

In addition to law enforcement, the Pennsylvania Department of Education (PDE) plays a crucial administrative role in managing public awareness, digital media literacy, and victim support within educational institutions. PDE provides guidance to K-12 public schools, intermediate units, and higher education institutions on handling deepfake incidents involving students or staff. Administrative reporting mechanisms, such as the statewide Safe2Say Something anonymous reporting program managed by the OAG, are integrated into school safety protocols to ensure rapid notification of AI abuse incidents affecting school communities across the Commonwealth.

Key Focus Areas

Act 125 focuses principally on two critical dimensions of synthetic media misuse: nonconsensual intimate deepfakes targeting adults and the creation or distribution of synthetic child sexual abuse material. In the context of intimate image abuse (18 Pa.C.S. § 3131), the law targets nonconsensual distribution involving current or former sexual or intimate partners, as well as synthetic depictions of non-partners created using generative AI tools. The legislation requires proving an intent to harass, annoy, or alarm the victim, establishing a statutory basis to halt digital extortion, 'revenge porn,' and harassment campaigns executed through synthetic media.

The second primary focus area is the protection of minors under 18 Pa.C.S. § 6312. The explosion of AI image generators created an urgent regulatory gap where actors attempted to argue that fully synthetic or computer-generated imagery fell outside legacy child pornography statutes. Act 125 eliminates this legal ambiguity by making it an explicit criminal offense to intentionally view, possess, control, produce, or distribute any AI-generated child sexual abuse material. This provision ensures that synthetic CSAM is treated with equal severity under criminal law as real-world media, closing legal loopholes exploited by digital offenders.

Implementation Framework

Implementation of Act 125 relies on multi-layered collaboration between state agencies, law enforcement, platform operators, and educational entities. When an individual discovers an AI-generated sexual depiction or deepfake, reporting guidelines established by PDE and law enforcement direct victims to preserve digital evidence—including application details, usernames, timestamps, and host platform URLs—and immediately notify local police or the Office of Attorney General. For incidents involving minors, schools are required to coordinate victim support services while avoiding the secondary forwarding or downloading of illegal media.

To assist in removing synthetic intimate media from public networks, Pennsylvania collaborates with non-profit entities and technical platforms. Specifically, PDE and law enforcement recommend utilizing tools such as the National Center for Missing & Exploited Children (NCMEC) 'Take It Down' service. This technology creates a cryptographic digital fingerprint ('hash') of explicit media or AI-generated imagery without storing the actual content, enabling participating online platforms to automatically detect and block identical synthetic images across their services. This cryptographic hashing mechanism serves as a primary technical pillar supporting the practical enforcement of Act 125.

Monitoring and Evaluation

Monitoring the implementation and effectiveness of Act 125 falls under the oversight of the Pennsylvania Office of Attorney General and state judicial authorities. The OAG tracks investigation metrics, felony charges, and convictions arising under 18 Pa.C.S. § 3131 and § 6312. Judicial records across Pennsylvania Courts of Common Pleas provide data on how prosecutors apply the statutory definitions of AI-generated content in criminal complaints and court proceedings.

Evaluation of the law performance is ongoing, as state lawmakers monitor technological advances in generative AI and deepfake detection tools. Recognizing that digital forgery extends beyond sexual depictions, Pennsylvania legislators introduced companion legislation, such as Act 35 of 2025, to continuously adjust state legal frameworks. State agencies evaluate whether additional tools, such as mandatory digital watermarking standards or social media content credential requirements, are necessary to complement criminal penalties under Act 125.

Penalties, Liability, and Appeals

Act 125 imposes serious criminal liability on individuals who violate its statutory prohibitions. Offenses involving the dissemination of nonconsensual AI-generated sexual depictions under 18 Pa.C.S. § 3131 are classified as criminal misdemeanors or felonies, depending on prior criminal history and the specific circumstances of the act. Penalties include substantial monetary fines, probationary supervision, and mandatory state imprisonment. Multiple individuals have been charged with felony offenses under the law by the Office of Attorney General.

For violations of 18 Pa.C.S. § 6312 involving AI-generated child sexual abuse material, penalties are categorized under severe felony classes, reflecting the gravity of child exploitation offenses. Individuals charged under Act 125 maintain standard constitutional appellate rights through the Pennsylvania court system, including the Court of Common Pleas, Superior Court, and Supreme Court of Pennsylvania. Defense proceedings evaluate elements such as criminal intent, identity verification, or lawful exception usage under law enforcement or judicial contexts.

Relationship to Other Instruments

Act 125 functions as a core element of Pennsylvania broader technological and school safety legal code. It directly complements Act 35 of 2025 (18 Pa.C.S. § 4101.1), which penalizes the creation of forged digital likenesses in audio, video, or visual form executed with intent to defraud or injure. Together, Act 125 and Act 35 provide statutory coverage against both sexual and financial or reputational AI abuses. Furthermore, Act 125 intersects with Pennsylvania educational laws, such as Act 57 of 2020 and Act 110 of 2020, which govern school safety officers, background screening, and required administrative actions for sexual assault adjudications within public K-12 school entities.

At the federal level, Act 125 operates alongside existing U.S. federal statutes and congressional proposals addressing deepfakes. While federal measures such as the DEEPFAKES Accountability Act and the TAKE IT DOWN Act focus on national security, digital watermarking, and federal criminalization of nonconsensual intimate images, Pennsylvania Act 125 provides immediate state-level criminal prosecution capability. The statute functions within the constitutional boundaries set by Section 230 of the Communications Decency Act (47 U.S.C. § 230), targeting individual creators and disseminators of unlawful synthetic content rather than online intermediaries that comply with federal takedown mandates.

International Alignment

While Act 125 is a state legislative enactment within the United States, its policy principles align closely with international standards governing AI risk management, image-based sexual abuse, and human rights. International frameworks, such as the European Union Artificial Intelligence Act (EU AI Act) and the OECD Principles on Artificial Intelligence, emphasize risk-based regulation, human dignity, transparency, and safeguards against AI-generated manipulation. Prohibitions against nonconsensual deepfakes in Pennsylvania mirror legislative trends in Canada, Australia, the United Kingdom, and the European Union.

Cross-border cooperation remains critical due to the global nature of internet platform hosting and digital distribution. International law enforcement networks, including Interpol and international child protection task forces, collaborate with federal and state law enforcement agencies when synthetic CSAM or targeted deepfake harassment campaigns cross international boundaries. Pennsylvania explicit statutory coverage of AI-generated depictions ensures statutory alignment when requesting international digital evidence or extradition assistance in complex cybercrime investigations.

Implementation Timeline

Compliance Checklist

Sources and References